Merged v2.6.0

.gitignore

@@ -104,3 +104,4 @@ venv.bak/
 
 # mypy
 .mypy_cache/
+example/test_db

CHANGELOG.md

@@ -1,4 +1,13 @@
 # Change Log
+## 2.6.0 (dev)
+   * Adding Backup Recovery Codes (Recovery) as a method.
+     Thanks to @Spitfireap for work, and  @peterthomassen for guidance.
+   * Added: `RECOVERY_ITERATION` to set the number of iteration when hashing recovery token
+   * Added: `MFA_ENFORCE_RECOVERY_METHOD` to enforce the user to enroll in the recovery code method once, they add any other method,
+   * Added: `MFA_ALWAYS_GO_TO_LAST_METHOD` to the settings which redirects the user automatically to the last used method when logging in
+   * Added: `MFA_RENAME_METHODS` to be able to rename the methods for the user.
+   * Fix: Alot of CSS fixes for the example application
+
 ## 2.5.0
 
    * Fixed: issue in the 'Authorize' button don't show on Firefox and Chrome on iOS.

EXAMPLE.md

@@ -4,5 +4,15 @@
 `virtualenv venv`
 1. activate env `source venv/bin/activate`
 1. install requirements `pip install -r requirements.txt`
+1. cd to example project `cd example`
 1. migrate `python manage.py migrate`
-1. create super user 'python manage.py createsuperuser' 
+1. create super user `python manage.py createsuperuser`
+1. start the server `python manage.py runserver`
+
+# Notes for SSL
+
+To test FIDO2 you need to use HTTPS, after the above steps are done:
+
+1. stop the server
+1. install requirements `pip install -r example-ssl-requirements.txt`
+1. start the ssl server `python manage.py runsslserver`

README.md

@@ -1,5 +1,5 @@
 # django-mfa2
-A Django app that handles MFA, it supports TOTP, U2F, FIDO2 U2F (Web Authn), Email Tokens , and Trusted Devices
+A Django app that handles MFA, it supports TOTP, U2F, FIDO2 U2F (Web Authn), Email Tokens , Trusted  Devices and backup codes.
 
 ### Pip Stats
 [![PyPI version](https://badge.fury.io/py/django-mfa2.svg)](https://badge.fury.io/py/django-mfa2)
@@ -66,37 +66,45 @@ Depends on
 `python manage.py collectstatic`
 3. Add the following settings to your file
 
-   ```python 
-   MFA_UNALLOWED_METHODS=()   # Methods that shouldn't be allowed for the user
+   ```python
+   from django.conf.global_settings import PASSWORD_HASHERS as DEFAULT_PASSWORD_HASHERS #Preferably at the same place where you import your other modules
+   MFA_UNALLOWED_METHODS=()   # Methods that shouldn't be allowed for the user e.g ('TOTP','U2F',)
    MFA_LOGIN_CALLBACK=""      # A function that should be called by username to login the user in session
    MFA_RECHECK=True           # Allow random rechecking of the user
    MFA_REDIRECT_AFTER_REGISTRATION="mfa_home"   # Allows Changing the page after successful registeration
    MFA_SUCCESS_REGISTRATION_MSG = "Go to Security Home" # The text of the link
    MFA_RECHECK_MIN=10         # Minimum interval in seconds
    MFA_RECHECK_MAX=30         # Maximum in seconds
    MFA_QUICKLOGIN=True        # Allow quick login for returning users by provide only their 2FA
+   MFA_ALWAYS_GO_TO_LAST_METHOD = False # Always redirect the user to the last method used to save a click (Added in 2.6.0).
+   MFA_RENAME_METHODS={} #Rename the methods in a more user-friendly way e.g {"RECOVERY":"Backup Codes"} (Added in 2.6.0)
    MFA_HIDE_DISABLE=('FIDO2',)     # Can the user disable his key (Added in 1.2.0).
    MFA_OWNED_BY_ENTERPRISE = FALSE  # Who owns security keys   
+   PASSWORD_HASHERS = DEFAULT_PASSWORD_HASHERS # Comment if PASSWORD_HASHER already set in your settings.py
+   PASSWORD_HASHERS += ['mfa.recovery.Hash'] 
+   RECOVERY_ITERATION = 350000 #Number of iteration for recovery code, higher is more secure, but uses more resources for generation and check...
 
    TOKEN_ISSUER_NAME="PROJECT_NAME"      #TOTP Issuer name
 
    U2F_APPID="https://localhost"    #URL For U2F
-   FIDO_SERVER_ID=u"localehost"      # Server rp id for FIDO2, it the full domain of your project
+   FIDO_SERVER_ID=u"localehost"      # Server rp id for FIDO2, it is the full domain of your project
    FIDO_SERVER_NAME=u"PROJECT_NAME"
-   FIDO_LOGIN_URL=BASE_URL
    ```
    **Method Names**
    * U2F
    * FIDO2
    * TOTP
    * Trusted_Devices
    * Email
+   * RECOVERY
 
    **Notes**:
     * Starting version 1.1, ~~FIDO_LOGIN_URL~~ isn't required for FIDO2 anymore.
     * Starting version 1.7.0, Key owners can be specified.
     * Starting version 2.2.0
         * Added: `MFA_SUCCESS_REGISTRATION_MSG` & `MFA_REDIRECT_AFTER_REGISTRATION`
+    Start version 2.6.0
+        * Added: `MFA_ALWAYS_GO_TO_LAST_METHOD`, `MFA_RENAME_METHODS`, `MFA_ENFORCE_RECOVERY_METHOD` & `RECOVERY_ITERATION`
 4. Break your login function
 
    Usually your login function will check for username and password, log the user in if the username and password are correct and create the user session, to support mfa, this has to change
@@ -136,7 +144,7 @@ Depends on
 ```<li><a href="{% url 'mfa_home' %}">Security</a> </li>```
 
 
-For Example, See 'example' app
+For Example, See 'example' app and look at EXAMPLE.md to see how to set it up.
 
 # Going Passwordless
 

example/example-ssl-requirements.txt

@@ -0,0 +1 @@
+django-sslserver

example/example/settings.py

@@ -11,6 +11,7 @@
 """
 
 import os
+from django.conf.global_settings import PASSWORD_HASHERS as DEFAULT_PASSWORD_HASHERS
 
 # Build paths inside the project like this: os.path.join(BASE_DIR, ...)
 BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -142,9 +143,14 @@
 MFA_HIDE_DISABLE=('',)     # Can the user disable his key (Added in 1.2.0).
 MFA_REDIRECT_AFTER_REGISTRATION="registered"
 MFA_SUCCESS_REGISTRATION_MSG="Go to Home"
-
+MFA_ALWAYS_GO_TO_LAST_METHOD = True
+MFA_ENFORCE_RECOVERY_METHOD = True
+MFA_RENAME_METHODS = {"RECOVERY":"Backup Codes","FIDO2":"Biometric Authentication"}
+PASSWORD_HASHERS = DEFAULT_PASSWORD_HASHERS #Comment if PASSWORD_HASHER already set
+PASSWORD_HASHERS += ['mfa.recovery.Hash']
+RECOVERY_ITERATION = 1 #Number of iteration for recovery code, higher is more secure, but uses more resources for generation and check...
 TOKEN_ISSUER_NAME="PROJECT_NAME"      #TOTP Issuer name
 
-U2F_APPID="https://localhost"    #URL For U2F
+U2F_APPID="https://localhost:9000"    #URL For U2F
 FIDO_SERVER_ID="localhost"      # Server rp id for FIDO2, it the full domain of your project
 FIDO_SERVER_NAME="TestApp"

example/example/templates/base.html

@@ -10,7 +10,7 @@
   <meta name="description" content="">
   <meta name="author" content="">
 
-  <title>SB Admin - Blank Page</title>
+  <title>Django-mfa2 Example</title>
 
   <!-- Custom fonts for this template-->
   <link href="{% static 'vendor/fontawesome-free/css/all.min.css'%}" rel="stylesheet" type="text/css">

mfa/Email.py

@@ -34,10 +34,16 @@ def start(request):
                 from django.core.urlresolvers import reverse
             except:
                 from django.urls import reverse
-            return HttpResponseRedirect(reverse(getattr(settings,'MFA_REDIRECT_AFTER_REGISTRATION','mfa_home')))
+            if getattr(settings, 'MFA_ENFORCE_RECOVERY_METHOD', False) and not User_Keys.objects.filter(
+                    key_type="RECOVERY", username=request.user.username).exists():
+                request.session["mfa_reg"] = {"method": "Email",
+                                              "name": getattr(settings, "MFA_RENAME_METHODS", {}).get("Email", "Email")}
+            else:
+                return HttpResponseRedirect(reverse(getattr(settings,'MFA_REDIRECT_AFTER_REGISTRATION','mfa_home')))
         context["invalid"] = True
     else:
         request.session["email_secret"] = str(randint(0,100000))  #generate a random integer
+
         if sendEmail(request, request.user.username, request.session["email_secret"]):
             context["sent"] = True
     return render(request,"Email/Add.html", context)

mfa/FIDO2.py

@@ -66,7 +66,11 @@ def complete_reg(request):
         uk.owned_by_enterprise = getattr(settings, "MFA_OWNED_BY_ENTERPRISE", False)
         uk.key_type = "FIDO2"
         uk.save()
-        return HttpResponse(simplejson.dumps({'status': 'OK'}))
+        if getattr(settings, 'MFA_ENFORCE_RECOVERY_METHOD', False) and not User_Keys.objects.filter(key_type = "RECOVERY", username=request.user.username).exists():
+            request.session["mfa_reg"] = {"method":"FIDO2","name": getattr(settings, "MFA_RENAME_METHODS", {}).get("FIDO2", "FIDO2")}
+            return HttpResponse(simplejson.dumps({'status': 'RECOVERY'}))
+        else:
+            return HttpResponse(simplejson.dumps({'status': 'OK'}))
     except Exception as exp:
         import traceback
         print(traceback.format_exc())
@@ -79,9 +83,11 @@ def complete_reg(request):
 
 
 def start(request):
-    """Start Registeration a new FIDO Token"""
+    """Start Registration a new FIDO Token"""
     context = csrf(request)
     context.update(get_redirect_url())
+    context["method"] = {"name":getattr(settings,"MFA_RENAME_METHODS",{}).get("FIDO2","FIDO2 Security Key")}
+    context["RECOVERY_METHOD"]=getattr(settings,"MFA_RENAME_METHODS",{}).get("RECOVERY","Recovery codes")
     return render(request, "FIDO2/Add.html", context)
 
 
@@ -137,7 +143,7 @@ def authenticate_complete(request):
             except:
                 pass
             return HttpResponse(simplejson.dumps({'status': "ERR",
-                                                  "message": excep.message}),
+                                                  "message": str(excep)}),
                                 content_type = "application/json")
 
         if request.session.get("mfa_recheck", False):

mfa/U2F.py

@@ -52,32 +52,38 @@ def validate(request,username):
 
     challenge = request.session.pop('_u2f_challenge_')
     device, c, t = complete_authentication(challenge, data, [settings.U2F_APPID])
+    try:
+        key=User_Keys.objects.get(username=username,properties__icontains='"publicKey": "%s"'%device["publicKey"])
+        key.last_used=timezone.now()
+        key.save()
+        mfa = {"verified": True, "method": "U2F","id":key.id}
+        if getattr(settings, "MFA_RECHECK", False):
+            mfa["next_check"] = datetime.datetime.timestamp((datetime.datetime.now()
+                                     + datetime.timedelta(
+                        seconds=random.randint(settings.MFA_RECHECK_MIN, settings.MFA_RECHECK_MAX))))
+        request.session["mfa"] = mfa
+        return True
+    except:
+        return False
+
 
-    key=User_Keys.objects.get(username=username,properties__shas="$.device.publicKey=%s"%device["publicKey"])
-    key.last_used=timezone.now()
-    key.save()
-    mfa = {"verified": True, "method": "U2F","id":key.id}
-    if getattr(settings, "MFA_RECHECK", False):
-        mfa["next_check"] = datetime.datetime.timestamp((datetime.datetime.now()
-                                 + datetime.timedelta(
-                    seconds=random.randint(settings.MFA_RECHECK_MIN, settings.MFA_RECHECK_MAX))))
-    request.session["mfa"] = mfa
-    return True
 
 def auth(request):
     context=csrf(request)
     s=sign(request.session["base_username"])
     request.session["_u2f_challenge_"]=s[0]
     context["token"]=s[1]
-
-    return render(request,"U2F/Auth.html")
+    context["method"] = {"name": getattr(settings, "MFA_RENAME_METHODS", {}).get("U2F", "Classical Security Key")}
+    return render(request,"U2F/Auth.html",context)
 
 def start(request):
     enroll = begin_registration(settings.U2F_APPID, [])
     request.session['_u2f_enroll_'] = enroll.json
     context=csrf(request)
     context["token"]=simplejson.dumps(enroll.data_for_client)
     context.update(get_redirect_url())
+    context["method"] = {"name": getattr(settings, "MFA_RENAME_METHODS", {}).get("U2F", "Classical Security Key")}
+    context["RECOVERY_METHOD"] = getattr(settings, "MFA_RENAME_METHODS", {}).get("RECOVERY", "Recovery codes")
     return render(request,"U2F/Add.html",context)
 
 
@@ -98,6 +104,11 @@ def bind(request):
     uk.properties = {"device":simplejson.loads(device.json),"cert":cert_hash}
     uk.key_type = "U2F"
     uk.save()
+    if getattr(settings, 'MFA_ENFORCE_RECOVERY_METHOD', False) and not User_Keys.objects.filter(key_type="RECOVERY",
+                                                                                                username=request.user.username).exists():
+        request.session["mfa_reg"] = {"method": "U2F",
+                                      "name": getattr(settings, "MFA_RENAME_METHODS", {}).get("U2F", "Classical Security Key")}
+        return HttpResponse('RECOVERY')
     return HttpResponse("OK")
 
 def sign(username):

mfa/recovery.py

@@ -0,0 +1,122 @@
+from django.shortcuts import render
+from django.views.decorators.cache import never_cache
+from django.template.context_processors import csrf
+from django.contrib.auth.hashers import make_password, PBKDF2PasswordHasher
+from django.http import HttpResponse
+from .Common import get_redirect_url
+from .models import *
+import simplejson
+import random
+import string
+import datetime
+from django.utils import timezone
+
+USER_FRIENDLY_NAME = "Recovery Codes"
+
+class Hash(PBKDF2PasswordHasher):
+    algorithm = 'pbkdf2_sha256_custom'
+    iterations = getattr(settings,"RECOVERY_ITERATION",1)
+
+def delTokens(request):
+    #Only when all MFA have been deactivated, or to generate new !
+    #We iterate only to clean if any error happend and multiple entry of RECOVERY created for one user
+    for key in User_Keys.objects.filter(username=request.user.username, key_type = "RECOVERY"):
+        if key.username == request.user.username:
+            key.delete()
+
+def randomGen(n):
+    return ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase + string.digits) for _ in range(n))
+
+@never_cache
+def genTokens(request):
+    #Delete old ones
+    delTokens(request)
+    #Then generate new one
+    salt = randomGen(15)
+    hashedKeys = []
+    clearKeys = []
+    for i in range(5):
+            token = randomGen(5) + "-" + randomGen(5)
+            hashedToken = make_password(token, salt, 'pbkdf2_sha256_custom')
+            hashedKeys.append(hashedToken)
+            clearKeys.append(token)
+    uk=User_Keys()
+
+    uk.username = request.user.username
+    uk.properties={"secret_keys":hashedKeys, "salt":salt}
+    uk.key_type="RECOVERY"
+    uk.enabled = True
+    uk.save()
+    return HttpResponse(simplejson.dumps({"keys":clearKeys}))
+
+
+def verify_login(request, username, token):
+    for key in User_Keys.objects.filter(username=username, key_type = "RECOVERY"):
+        secret_keys = key.properties["secret_keys"]
+        salt = key.properties["salt"]
+        hashedToken = make_password(token, salt, "pbkdf2_sha256_custom")
+        for i,token in enumerate(secret_keys):
+            if hashedToken == token:
+                secret_keys.pop(i)
+                key.properties["secret_keys"] = secret_keys
+                key.last_used= timezone.now()
+                key.save()
+                return [True, key.id, len(secret_keys) == 0]
+    return [False]
+
+def getTokenLeft(request):
+    uk = User_Keys.objects.filter(username=request.user.username, key_type = "RECOVERY")
+    keyLeft=0
+    for key in uk:
+        keyLeft += len(key.properties["secret_keys"])
+    return HttpResponse(simplejson.dumps({"left":keyLeft}))
+
+def recheck(request):
+    context = csrf(request)
+    context["mode"]="recheck"
+    if request.method == "POST":
+        if verify_login(request,request.user.username, token=request.POST["recovery"])[0]:
+            import time
+            request.session["mfa"]["rechecked_at"] = time.time()
+            return HttpResponse(simplejson.dumps({"recheck": True}), content_type="application/json")
+        else:
+            return HttpResponse(simplejson.dumps({"recheck": False}), content_type="application/json")
+    return render(request,"RECOVERY/recheck.html", context)
+
+@never_cache
+def auth(request):
+    from .views import login
+    context=csrf(request)
+    if request.method=="POST":
+        tokenLength = len(request.POST["recovery"])
+        if tokenLength == 11 and "RECOVERY" not in settings.MFA_UNALLOWED_METHODS:
+            #Backup code check
+            resBackup=verify_login(request, request.session["base_username"], token=request.POST["recovery"])
+            if resBackup[0]:
+                mfa = {"verified": True, "method": "RECOVERY","id":resBackup[1], "lastBackup":resBackup[2]}
+                # if getattr(settings, "MFA_RECHECK", False):
+                #     mfa["next_check"] = datetime.datetime.timestamp((datetime.datetime.now()
+                #                             + datetime.timedelta(
+                #                 seconds=random.randint(settings.MFA_RECHECK_MIN, settings.MFA_RECHECK_MAX))))
+                request.session["mfa"] = mfa
+                if resBackup[2]:
+                    #If the last bakup code has just been used, we return a response insead of redirecting to login
+                    context["lastBackup"] = True
+                    return render(request,"RECOVERY/Auth.html", context)                
+                return login(request)
+        context["invalid"]=True
+
+    elif request.method=="GET":
+        mfa = request.session.get("mfa")
+        if mfa and mfa["verified"] and mfa["lastBackup"]:
+            return login(request)
+
+    return render(request,"RECOVERY/Auth.html", context)
+
+@never_cache
+def start(request):
+    """Start Managing recovery tokens"""
+    context = get_redirect_url()
+    if "mfa_reg" in request.session:
+        context["mfa_redirect"] = request.session["mfa_reg"]["name"]
+    return render(request,"RECOVERY/Add.html",context)